On 10/18/23 at 08:45pm, Philip Li wrote: > On Wed, Oct 18, 2023 at 08:12:30PM +0800, Baoquan He wrote: > > Hi Dan, > > > > On 10/18/23 at 01:32pm, Dan Carpenter wrote: > > > On Wed, Oct 18, 2023 at 04:54:33PM +0800, Baoquan He wrote: > > > > Hi, > > > > > > > > On 10/17/23 at 05:26pm, Dan Carpenter wrote: > > > > > tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master > > > > > head: 213f891525c222e8ed145ce1ce7ae1f47921cb9c > > > > > commit: 4c91c07c93bbbdd7f2d9de2beb7ee5c2a48ad8e7 mm: vmalloc: convert vread() to vread_iter() > > > > > config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@xxxxxxxxx/config) > > > > > compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 > > > > > reproduce: (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@xxxxxxxxx/reproduce) > > > > > > > > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > > > > > the same patch/commit), kindly add following tags > > > > > | Reported-by: kernel test robot <lkp@xxxxxxxxx> > > > > > | Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > > > > > | Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@xxxxxxxxx/ > > > > > > > > > > smatch warnings: > > > > > mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) > > > > > > > > I see the code deficit, while the reproduce link seems to be unavilable. > > > > Could you double check the link and provide a good one so that I can > > > > verify the code fix? > > > > > > Here's a link. :) > > > > > > https://repo.or.cz/smatch.git/blob/HEAD:/Documentation/smatch.txt > > > > > > Just build it and run: > > > > > > ~/smatch/smatch_scripts/kchecker drivers/whatever/file.c > > > > I don't know smatch and lkp well, and have no idea on how to use above > > Hi Baoquan, sorry there's issue in the generation of reproduce step, but even > it is generated, it doesn't contain the detail to setup smatch. You can follow > the smatch.txt to do the setup. > > > smatch.txt to build the target file.c. I meant in this lkp report, the > > config file is available, however, the reproduce file is empty. Could > > you help add an available reproduce file link? or give a little more > > detail guiding me how to make use of above smatch file to build .c file? > > On the other side, Dan has added analysis to the report as below. > It's possible to resolve the issue without running the smatch check. > You can give this a try. > > 06c8994626d1b7 Baoquan He 2023-02-06 3657 if (!vm && !flags) > > NULL check > > ... > > 06c8994626d1b7 Baoquan He 2023-02-06 @3689 else if (!(vm->flags & VM_IOREMAP)) > ^^^^^^^^^ > Unchecked dereference Thanks for the detailed explanation, Philipp. Yes, the code deficit is identified. I planned to reproduce and verify with LKP's reproducer so that it's 100% clear. Anyway, below patch should fix it. >From a39fdd50030a7d88a7f69bcba29e6f75020a1915 Mon Sep 17 00:00:00 2001 From: Baoquan He <bhe@xxxxxxxxxx> Date: Wed, 18 Oct 2023 22:50:14 +0800 Subject: [PATCH] mm/vmalloc: fix the unchecked dereference warning in vread_iter() Content-type: text/plain LKP reported smatch warning as below: =================== smatch warnings: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) ...... 06c8994626d1b7 @3667 size = vm ? get_vm_area_size(vm) : va_size(va); ...... 06c8994626d1b7 @3689 else if (!(vm->flags & VM_IOREMAP)) ^^^^^^^^^ Unchecked dereference ===================== So add checking on whether 'vm' is not null when dereferencing it in vread_iter(). This mutes smatch complaint. Reported-by: kernel test robot <lkp@xxxxxxxxx> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@xxxxxxxxx/ Signed-off-by: Baoquan He <bhe@xxxxxxxxxx> --- mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index aad48ed8d86b..2cc992392db7 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -3813,7 +3813,7 @@ long vread_iter(struct iov_iter *iter, const char *addr, size_t count) if (flags & VMAP_RAM) copied = vmap_ram_vread_iter(iter, addr, n, flags); - else if (!(vm->flags & VM_IOREMAP)) + else if (!(vm && (vm->flags & VM_IOREMAP))) copied = aligned_vread_iter(iter, addr, n); else /* IOREMAP area is treated as memory hole */ copied = zero_iter(iter, n); -- 2.41.0
